Video motion anomaly detector

ABSTRACT

The Video Motion Anomaly Detector addresses the problem of automatically detecting events of interest to operators of CCTV systems used in security, transport and other applications, processing CCTV images. The detector may be used in a number of ways, for example to raise an alarm, summoning a human operator to view video data, or to trigger selective recording of video data or to insert an index mark in recordings of video data.

The present invention relates to devices and methods for processingvideo images to raise an alarm signal when an event of interest isdetected.

Closed circuit television (CCTV) is widely used for security, transportand other purposes. Example applications include the observation ofcrime or vandalism in public open spaces or buildings (such as hospitalsand schools), intrusion into prohibited areas, monitoring the free flowof road traffic, detection of traffic incidents and queues, detection ofvehicles travelling the wrong way on one-way roads.

The monitoring of CCTV displays (by human operators) is a very laborioustask however and there is considerable risk that events of interest maygo unnoticed. This is especially true when operators are required tomonitor a number of CCTV camera outputs simultaneously. As a result inmany CCTV installations, video data is recorded and only inspected indetail if an event is known to have taken place. Even in these cases,the volume of recorded data may be large and the manual inspection ofthe data may be laborious. Consequently there is a requirement forautomatic devices to process video images and raise an alarm signal whenthere is an event of interest. The alarm signal can be used either todraw the event to the immediate attention of an operator, to place anindex mark in recorded video or to trigger selective recording of CCTVdata.

Some automatic event detectors have been developed for CCTV systems,though few of these are very successful. The most common devices arecalled video motion detectors (VMDs) or activity detectors, though theyare generally based on simple algorithms concerning the detection ofchanges in the brightness of the video image—not the actual movement ofimaged objects. For the purposes of detecting changes in brightness, thevideo image is generally divided into a grid of typically 16 blockshorizontally and vertically (i.e. 256 blocks in total). There severaldisadvantages of these algorithms. For example, they are prone to falsealarms, for example when there are changes to the overall levels ofillumination. Furthermore, they are unable to detect the movement ofsmall objects, because of the block-based processing. In addition, theycannot be applied if the scene normally contains moving objects whichare not of interest. These disadvantages can be reduced to a limitedextent by additional processing logic, but the effectiveness of standardVMDs is inherently limited by the use of change detection as the initialimage-processing stage.

There is another type of detection device, which is characterised by theuse of complex algorithms involving image segmentation, objectrecognition and tracking and alarm decision rules. Though these devicescan be very effective, they are generally expensive systems designed foruse in specific applications and do not perform well without carefultuning and setting-up, and may not work at all outside of a limitedrange of applications for which they were originally developed.

U.S. Pat. No. 6,081,606 by inventors Wade & Jeffrey describes anapparatus and a method for detecting motion within an image sequence.That document discloses that motion within an image may be calculated bycorrelating areas of one image with areas of the next image in the videoto generate a flow field. The flow field is then analysed and an alarmraised dependent on the observed magnitude and direction of flow.

European Patent No 0 986 912 describes a method for monitoring apredetermined surveillance region. A video image is divided into anumber of segments. A statistical distribution for the mean grey levelis determined for each segment. A change in mean grey level for asegment, outside the usual statistical variation, may be used to triggeran alarm.

The Video Motion Anomaly Detector addresses the problem of automaticallydetecting events of interest to operators of CCTV systems used insecurity, transport and other applications, processing CCTV images. Thedetector may be used in a number of ways, for example to raise an alarm,summoning a human operator to view video data, or to trigger selectiverecording of video data or to insert an index mark in recordings ofvideo data.

Accordingly, the present invention provides a method for processingvideo images to detect an event of interest, comprising the steps of:receiving a video signal representing the video images to be processed;extracting at least one point feature from the video signal; trackingthe position and movement of the at least one point feature within thevideo images to generate a corresponding at least one track, eachrepresenting a corresponding point feature; using an iterative learningprocess to derive a normal pattern of behaviour for each track;comparing present behaviour of the at least one track to the respectivenormal pattern of behaviour; and in response to the present behaviourfalling outside the normal pattern of behaviour, generating an alarmsignal.

The alarm signal may cause at least one of the following effects: drawthe attention of an operator; place an index mark at the appropriateplace in recorded video data; and trigger selective recording of videodata.

The learning process may accumulate data representing the behaviour ofthe track(s) over a period of time in a four-dimensional histogram, saidfour dimensions representing x-position, y-position, x-velocity andy-velocity, of the track(s) within the video image. Furthermore, thelearn behaviour stage may segregate the tracks according to a velocitythreshold; wherein tracks moving at a velocity below the velocitythreshold are considered stationary while tracks moving at a velocity inexcess of the velocity threshold are considered mobile; wherein dataconcerning the mobile tracks is stored in said four-dimensionalhistogram, data concerning the stationary tracks being stored in atwo-dimensional histogram, said two dimensions representing x-positionand y-position within the video image. Furthermore, a cell size of thefour-dimensional histogram may vary in accordance with a measured speedin the image of each respective track. The histogram may be periodicallyde-weighted in order to bias the result of the learning process towardsmore recent events.

The comparison process may classify a track according to a comparison ofthe frequency of occupation of the corresponding histogram cell with anoccupancy threshold. The comparison process may act to classify asnormal behaviour a track adjacent or near a cell which is above theoccupancy threshold, despite the track appearing in a cell below theoccupancy threshold, where one cell is considered to be near another ifthe distance between them is below a predetermined distance threshold.

Abnormal tracks may be filtered, whereby an active alarm signal isgenerated in response to an abnormal track which resembles a number ofother abnormal tracks, in terms of at least one of position, velocityand time.

Abnormal tracks may be filtered, whereby an active alarm signal isgenerated in response only to an abnormal track which has beenclassified as abnormal on a predetermined number of occasions.

Abnormal tracks may be filtered, whereby an active alarm signal isgenerated in response only to a track being classified as abnormal forthe first time.

Abnormal tracks may be filtered, whereby an active alarm signal isgenerated only in response to a filtered version of the classificationrising above a predetermined threshold value.

Subsequent active alarm signals may be inhibited for a predeterminedtime interval after a first active alarm signal has been produced.

Subsequent active alarm signals may be inhibited if caused by anabnormal track within a predetermined distance of another track whichhas previously generated an alarm.

The present invention also provides apparatus for processing videoimages to detect an event of interest, comprising: a source of videoimages, producing a video signal representing the video images to beprocessed; a feature extraction device receiving the video signal andproducing data representing at least one point feature detected withinthe image; a feature tracking device receiving the data representingpoint features and producing data representing tracks, beingrepresentative of the position and speed of each respective pointfeature, within the image; a learning device receiving the datarepresenting the tracks and producing a signal representing a range ofbehaviour considered normal by the learning device, in response tooperation of a learning process on the data representing the tracks; aclassification device receiving oth the signal representing the normalrange of behaviour of the tracks and the data representing the tracks,being adapted to compare the signal and the data and to issue anormal/abnormal signal in accordance with the outcome of suchcomparison; and an alarm generation device receiving the normal/abnormalsignal and generating at least one active alarm signal in response tothe normal/abnormal signal indicating abnormal behaviour of at least onetrack.

The above, and further, objects, characteristics and advantages of thepresent invention will become more apparent from the followingdescription of certain embodiments thereof, with reference the FIG. 1which shows schematic block diagram of a video motion anomaly detectoraccording to the present invention.

The present invention provides a video motion anomaly detector that isfeature-based, and generates alarms on the basis of abnormal behaviourof a track representing the behaviour of a point feature. The knownsystems do not have these characteristics.

The video motion anomaly detector extracts and tracks point-likefeatures in video images and raises an alarm when one or more track(s)each representing a feature is/are behaving abnormally compared with thebehaviour of those tracks observed over a period of time. By “behaviour”we mean the movement of tracks in different parts of the video image.For example, rapid movement of features in a particular direction in onepart of the field of view may be normal, but it may be abnormal if itoccurred in another part of the field of view where the normal behaviouris slow movement. Similarly, rapid movement in the same part of thefield of view may be abnormal if the movement is in a differentdirection.

FIG. 1 shows the main processing stages in the video motion anomalydetector.

An incoming video signal 10 is provided by a source of video images, forexample a CCTV camera. The video signal 10 represents video imagesgenerated by the source of video images. Typically, the video imageswill show a view of an area surveyed by a CCTV security camera.

The video signal 10 is supplied to a feature extraction stage 1. Thefeature extraction stage 1 locates point-like features in each processedimage in the video image sequence. A suitable feature extraction processis described in Patent No: GB2218507, “Digital Data Processing”. Thelocated features are identified in a signal 12 provided to the nextstage, feature tracking stage 2.

The feature tracking stage 2 tracks features so that each point-likefeature can be described by its current position and its estimatedvelocity in the image. The feature tracking stage 2 provides a track,that is a signal 14 indicating the current position and estimatedvelocity in the image, for each tracked feature, to a learn behaviourstage 3 and to a track classification stage 4.

The learn behaviour stage 3 accumulates information about the behaviourof features over a period of time. One way of doing this is toaccumulate a four-dimensional histogram, the four dimensions of thehistogram being x-position, y-position, x-velocity, y-velocity.

The track classification stage 4 classifies each track as being ‘normal’or ‘abnormal’, as compared with the behaviour information accumulated bythe learn behaviour stage 3.

One way of classifying a track is to compare the frequency of occupancyof the corresponding histogram cell with a threshold. If the frequencyof occupancy is below the threshold, the track is classified asabnormal, otherwise it is considered normal. The track classificationstage 4 sends a normal/abnormal signal 18 to an alarm generation stage5. If any of the tracked features show abnormal behaviour, then thissignal will inform the alarm generation stage 5 of the abnormality.

The alarm generation stage 5 generates an alarm signal 20 in response toan active normal/abnormal signal 18, indicating that at least oneabnormal track has been found to be present. Additional processing logicmay be provided to resolve situations such as intermittent abnormalbehaviour or multiple instances of abnormal behaviour associated withone real-world event, and other such situations.

The video motion anomaly detector of the present invention preferablyprovides at least one of the following features: the use of pointfeature extraction and tracking in an event detector; and the detectionof events by classification of track behaviour as being abnormal,compared with the behaviour of tracks observed over time.

Compared with event detection based on a known video motion detection,the video motion anomaly detector of the present invention provides atleast some of the following advantages.

-   -   It is based on point-feature extraction rather than detecting        changes in image rightness. This makes the system of the        invention relatively insensitive to changes in scene        illumination levels. Scene illumination levels are major source        of false alarms in known video motion detectors.    -   Because it is based on the detection of point features rather        than block processing, the system of the invention is able to        detect the movement of even relatively small objects, and to        indicate an alarm condition if the movement is unusual.    -   The system of the invention accumulates information about the        behaviour of each tracked feature, enabling it to build up a        definition of ‘normal’ behaviour for each feature. The system of        the invention can then detect movement of interest, that is,        movement departing from ‘normal’ behaviour for that particular        feature, even in the presence of other features moving        ‘normally’.    -   The system of the invention detects abnormal behaviour, that is,        behaviour departing from the calculated ‘normal’ behaviour for a        particular feature, rather than pre-defined specific behaviour.        The invention may accordingly be applied to a very wide range of        different applications with little special setting-up, and can        adapt to long-term or permanent changes in the viewed image.

Compared with existing event detection systems based on complex softwaresolutions, the video motion anomaly detector of the present invention isa relatively simple system suitable for implementation in relativelyinexpensive hardware.

The main processing stages of the video motion anomaly detector are nowdescribed in more detail, with reference to FIG. 1.

FIG. 1 schematically shows the main processing stages in a video motionanomaly detector of the present invention, receiving video information10, and producing an alarm signal 20.

The feature extraction stage 1 locates point-like features in eachprocessed image in the video image sequence. A preferred featureextractor is described in Patent No: GB2218507, “Digital DataProcessing” and this is further described by Harris and Stephens in theProceedings of the 4th Alvey Vision Conference, September 1988,University of Manchester, “A combined corner and edge detector”. Animportant aspect of this feature extractor is that it provides featureattributes, i.e. quantitative descriptions of the extracted features inaddition to their position in the image. Compared with otherpoint-feature extraction algorithms the Harris method is particularlyrobust.

Other point-feature extraction techniques have been developed, and couldbe used within the present invention. For example, one such technique isdescribed by Moravec in Tech Report CMU-RI-TR-3, Carnegie-MellonUniversity, Robotics Institute, September 1980 “Obstacle avoidance andnavigation in the real world by a seeing robot rover”. Other ad hocschemes can be envisaged.

Indeed, any algorithm that can be used to extract image features thatcan be associated with a locality can be used as a point-like featureextractor in the present invention. As examples, knot-points, that is tosay points of high curvature on edge features, can be assigned aposition. A feature such as an image region, for example an entirevehicle or person, segmented by edge-finding or region growingtechniques, can be assigned the position of its centroid.

The feature extractor 1 may employ a fixed feature-strength threshold,in which case the number of extracted features may vary from frame toframe and it may vary from one application to another. Alternatively,the threshold may be varied so that a fixed number of features areextracted.

The feature tracking stage 2 tracks features between image frames sothat each point-like feature can be described by its current positionand its estimated velocity in the image.

In the present application a multi-target tracking algorithm is requiredas a scene may contain a large number of moving objects and each maygive rise to a number of extracted features. For example, a car passingthrough the field of view may generate a number of extracted features oneach video frame, depending on the spatial resolution used, and atraffic scene may contain a number of cars moving in different parts ofthe field of view. Tracking algorithms are themselves relativelywell-known and understood. A treatise on the subject is given byBlackman & Popoli in “Design & Analysis of Modern Tracking Systems”,Artech House 1999.

Tracking is a cyclic process. At any time, a number of objects may bebeing tracked. Their current position and velocity are known and as eachnew frame of video data is presented, the track information needs to beupdated. Such a tracking algorithm typically consists of the followingstages.

-   -   Plot (feature)-to-track association: this is the process of        deciding which of the features, extracted from the most recent        video frame, is the same object as that represented by any        particular track. As “plot” rather than “feature” is the normal        term used in discussion of tracking algorithms, “plot” will be        used in this section of the description. A standard approach is        to only consider for association plots that fall within a window        or gate, which is centred on the plot's predicted position (see        below). Many tracking algorithms then employ simple rules to        handle situations where more than one plot falls in the        acceptance gate. Example rules include ‘associate the plot        nearest to the predicted position’, or ‘associate neither’.        These options will be discussed below. In the present        application the density of plots is typically high and the        possibility of plot-to-track association error is high so the        preferred approach makes use of the similarity of plot (feature)        attributes as well as plot position in making the plot-to-track        association decision. Other schemes for resolving ambiguities        are possible, for example probabilistic matching,        multiple-hypothesis tracking and deferred decision making. Other        refinements may be employed to improve performance, for example        cross-correlation of image patches to confirm the similarity of        imaged features, or variation of the acceptance window size        according to the expected accuracy of prediction. This latter        option will allow well established and slow moving tracks to        have a smaller acceptance window than fast moving or newly        formed tracks. Bi-directional matching schemes are also        possible.    -   Track Maintenance: this is the process of initiating new tracks,        typically because a new object has come into view, and deleting        tracks, typically because a tracked feature is no longer in        view. Most tracking algorithms will also have a track        confirmation process for deciding whether a track is        sufficiently well-established as to be the basis for subsequent        decision making. In a preferred implementation, new tracks are        initiated from plots that cannot be accounted for after        plot-to-track association with existing tracks. Because of        uncertainties in the performance of the feature extractor,        tracks are not immediately deleted in the preferred        implementation if they are not associated with any plot.        Instead, a track may “coast” for a number of frames before        deletion. Tracks are confirmed once they have been successfully        associated with plots on a number of frames.

Tracking feature of low feature strength is problematic, because theyare not reliably detected on each video frame. Tracking errors becomemore common when the tracks are closely spaced. One way of reducing thisproblem is to ignore unmatched plots of a low feature-strength, and onlyinitiate new tracks for unmatched plots of a higher feature-strength.

-   -   Track filtering and prediction: this is the process of        estimating the current plot position and velocity, and        predicting the expected plot position on subsequent image        frames. This process is required because measurements of feature        positions may be imperfect because of pixel quantisation and        image noise, and objects may move appreciably between image        frames. A number of methods are applicable, for example        recursive Kalman or Alpha-Beta filtering, fitting polynomial        splines to recent plot data etc. Performance here may be        improved by a number of schemes, for example outlier removal and        varying the order of a polynomial spline according the length of        a track's history.

In general, tracking algorithms follow a common pattern thoughindividual implementations may vary in detail according toapplication-specific factors and other issues.

The learn behaviour stage 3 accumulates information about the behaviourof tracks, representing tracked features, over a period of time. Thepreferred way of doing this is to accumulate a four-dimensionalhistogram, the four dimensions of the histogram being x-position,y-position, x-velocity, y-velocity. Alternatively, other co-ordinatesystems might be used such as polar co-ordinates or Hough transformspace co-ordinates, etc.

The behaviour histogram, being four-dimensional, may require a largeamount of data storage and this may be impractical for implementation inprocessing hardware. The referred way of overcoming this problem is topartition the histogram into two sections. The first is for stationarytracks, i.e. very slow moving ones. This section is a two-dimensionalhistogram and so may use a fine cell size without requiring largeamounts of storage. The second histogram section is for moving objectsof different speeds. Although this is a four-dimensional histogram, acoarser cell size may be used for such objects so the size of thissection of the histogram also need not be large. The size of the secondpartition may also be reduced by using a cell size which varies withspeed.

There are a number of alternative ways of constructing the histogram tominimise memory requirements. These include quad tree and other sparsematrix representation techniques.

The histogram describing behaviour may be built up over a fixed periodof time and remain unchanged thereafter. This has the disadvantage thatslow changes in actual behaviour, drift in camera electronics or saggingof camera mounts etc, may ultimately result in normal behaviour beingclassified as abnormal. This may be overcome in a number of ways. In thepreferred method, the histogram is periodically de-weighted by a factorclose to unity, with the result that the system has a fading memory,i.e. its memory is biased towards most recent events. Depending onprocessor limitations, it may be necessary to implement the fadingmemory in ways to reduce processor load. For example, the de-weightingmight be applied at a larger interval, or only a part of the histogrammight be de-weighted at shorter intervals. Another way of biasing memoryof behaviour to recent events, albeit not a fading memory, is to use twohistogram stores, one being built up while the other is being used fortrack classification.

While histogramming is the preferred approach, there are other possiblelearning and classification methods, and some of these are discussedbelow.

The track classification stage 4 classifies each track as being ‘normal’or ‘abnormal’ and the method used depends on how behaviour is beinglearnt in the learn behaviour stage 3. In the preferred histogram-basedmethod, a track is classified by comparing the frequency of occupancy ofthe corresponding histogram cell with an occupancy threshold. If thefrequency of occupancy is below the threshold, the track is classifiedas abnormal, otherwise it is considered normal.

If a very low false alarm rate is required, it may be necessary to takeadditional steps to prevent an adverse system response, particularly ifthe training time has been limited. As an example of such steps, a trackmay be classified as normal, even if the occupancy of the correspondinghistogram cell is low, if it is adjacent or near an above thresholdcell. The distance from the corresponding histogram cell to the nearestabove occupancy threshold cell (measured within the histogram bycity-block, Cartesian or some other metric which may be occupancyweighted) may be compared with a distance threshold. If the distance isless than the threshold, the track is classified as normal, otherwisethe track is considered abnormal. The false alarm rate can be adjustedby varying the occupancy threshold and the distance threshold. As analternative to the use of a distance threshold, histogram data might beblurred to suppress the classification of tracks as abnormal in cellsclose to high occupancy cells. Similarly, other morphological operatorsmight be applied.

The alarm generation stage 5 generates an alarm signal 20 when abnormaltracks are found to be present, subject to additional processing logicto resolve situations such as intermittent abnormal behaviour ormultiple instances of abnormal behaviour associated with one real-worldevent, and other situations such as when spurious track data isgenerated by a tracking error.

The risk of alarms being generated by spurious data can be reduced bylimiting processing to confirmed tracks or tracks whose track historyshows a consistent history of associated plots. Alarms generated byspurious data can also be reduced by limiting processing to either:abnormal tracks which occur in close proximity (in terms of any of:position, velocity or time) to a number of other abnormal tracks,and/or: tracks which are classified as abnormal on a number ofoccasions.

To prevent intermittent alarms, an alarm signal 20 can be raised(subject to other logic) only when a track is classified as abnormal forthe first time, or when a filtered version of the classification risesabove a threshold.

Multiple alarms might be generated, for example, if a vehicle viewed bythe CCTV system takes an abnormal path and generates a number ofseparate abnormal tracks in the process—the different tracks beinggenerated by different parts of the vehicle. These multiple alarms wouldbe confusing and unwanted in a practical system. These can be suppressedby inhibiting alarms for a period of seconds after a first alarm.Alternatively, alarms could be suppressed if the track causing the alarmis within some distance of a track that has previously generated analarm.

A number of different methods of alarm generation logic can beenvisaged, with different ad hoc formulations.

The above sections describe preferred methods for use within the presentinvention, although alternative learning and classification methods maybe used. A selection of such alternatives described below.

Fan-in/Fan-out (MLP) Neural Net. In outline, the idea is to use amulti-layer perceptron with 4 input nodes (for track data X, Y, Vx, Vy)and 4 output nodes, but an intermediate layer of 2 or 3 nodes. Theperceptron is a program that learn concepts, i.e. it can learn torespond with True (1) or False (0) for inputs we present to it, byrepeatedly “studying” examples presented to it. The Perceptron is aneural network whose weights and biases may be trained to produce acorrect target vector when presented with the corresponding inputvector. The training technique used is called the perceptron learningrule. The perceptron is able to generalise from its training vectors andwork with randomly distributed connections. Perceptrons are especiallysuited for simple problems in pattern classification. The network wouldbe trained to reconstruct its own input. Because of the internalconstriction, the reconstruction should be better for “normal” tracksand worse for “abnormal” tracks. Thus, the accuracy of reconstructioncould be used to assess the normality of the track.

Nearest Neighbour. Here, tracked feature data for recent frames isretained to create a track history database. Each new track is testedfor normality by searching this database to find any similar previoustracks.

Pruned Nearest Neighbour. This is a variation of the full nearestneighbour technique. The history database is reduced in size by omittingduplicates or near duplicates of earlier data.

Kohonen Net. Although this is a neural net technique, this can be viewedas similar to the pruned nearest neighbour method. The behaviour oftracked objects is described by a set of nodes positioned in thefour-dimensional input space. The actual positions of the nodes aredetermined by an iterative training process. This method is also relatedto adaptive code-book generation methods used in data compressionsystems.

Probabilistic Checking. This is a lateral approach to searching historydatabases for the nearest neighbour-based algorithms. Here, the historydatabase is searched by choosing for comparison entries in a randomsequence until a number of matches are found. If the track being checkedis very normal, a number of matches will be found very quickly.

Accordingly, the present invention provides a video motion anomalydetector which addresses the problem of automatically detecting eventsof interest to operators of CCTV systems used in security, transport andother applications, by processing CCTV images. The detector may be used,for example, to activate an alarm to summon a human operator to viewvideo data, to trigger selective recording of video data or to insert anindex mark in recordings of video data. The video motion anomalydetector of the present invention extracts and tracks point-likefeatures in video images and raises an alarm when a feature is behavingabnormally, compared with the ‘normal’ behaviour of those features,derived from observations of that feature over a period of time.

Existing video motion detectors are devices which are essentially basedon detecting changes in image brightness averaged over image sub-blocks.The video motion anomaly detector of the present invention has theadvantage of being less prone to false alarms caused by changes in sceneillumination levels. The detector of the present invention can alsodetect the movement of smaller objects and detect movements of interest,even in the presence of other moving objects. Further, it can be appliedto a very wide range of different applications with little specialsetting. Compared with other existing event detection systems based oncomplex software solutions, the video motion anomaly detector can beimplemented in relatively inexpensive hardware.

1. A method for processing video images to detect an event of interest,comprising the steps of: receiving a video signal representing the videoimages to be processed; extracting at least one point feature from thevideo signal; tracking the position and movement of the at least onepoint feature within the video images to generate a corresponding atleast one track, each representing a corresponding point feature; usingan iterative learning process to derive a normal pattern of behavior foreach track; comparing present behavior of the at least one track to therespective normal pattern of behavior; and in response to the presentbehavior falling outside the normal pattern of behavior, generating analarm signal.
 2. A method according to claim 1, wherein the alarm signalcauses at least one of the following effects: draw the attention of anoperator; place an index mark at the appropriate place in recorded videodata; and trigger selective recording of video data.
 3. A methodaccording to claim 1, wherein the learning process accumulates datarepresenting the behavior of the track(s) over a period of time in afour-dimensional histogram, said four dimensions representingx-position, y-position, x-velocity and y-velocity, of the track(s)within the video image.
 4. A method according to claim 3, wherein thelearn behavior stage segregates the tracks according to a velocitythreshold; wherein tracks moving at a velocity below the velocitythreshold are considered stationary while tracks moving at a velocity inexcess of the velocity threshold are considered mobile; wherein dataconcerning the mobile tracks is stored in said four-dimensionalhistogram, data concerning the stationary tracks being stored in atwo-dimension histogram, said two dimensions representing x-position andy-position within the video image.
 5. A method according to claim 3,wherein a cell size of the four-dimensional histogram varies inaccordance with a measured speed in the image of each respective track.6. A method according to claim 3, wherein the histogram is periodicallyde-weighted in order to bias the result of the learning process towardsmore recent events.
 7. A method according to claim 1, wherein thecomparison process classifies a track according to a comparison of thefrequency of occupation of the corresponding histogram cell with anoccupancy threshold.
 8. A method according to claim 7 wherein thecomparison process acts to classify as normal behavior a track adjacentor near a cell which is above the occupancy threshold, despite the trackappearing in a cell below the occupancy threshold, where one cell isconsidered to be near another if the distance between them s below apredetermined distance threshold.
 9. A method according to claim 1,wherein abnormal tracks are filtered, whereby an active alarm signal isgenerated in response to an abnormal track which resembles a number ofother abnormal tracks, in terms of at least one of position, velocityand time.
 10. A method according to claim 1, wherein abnormal tracks arefiltered, whereby an active alarm signal is generated in response onlyto an abnormal track which has been classified as abnormal on apredetermined number of occasions.
 11. A method according to claim 1,wherein abnormal tracks are filtered, whereby an active alarm signal isgenerated in response only to a track being classified as abnormal forthe first time.
 12. A method according to claim 1, wherein abnormaltracks are filtered, whereby an active alarm signal is generated only inresponse to a filtered version of the classification rising above apredetermined threshold value.
 13. A method according to claim 1,wherein subsequent active alarm signals are inhibited for apredetermined time interval after a first active alarm signal has beenproduced.
 14. A method according to claim 1, wherein subsequent activealarm signals are inhibited if caused by an abnormal track within apredetermined distance of another track which has previously generatedan alarm.
 15. Apparatus for processing video images to detect an eventof interest, comprising: a source of video images, producing a videosignal representing the video images to be processed; a featureextraction device receiving the video signal and producing datarepresenting at least one point feature detected within the image; afeature tracking device receiving the data representing point featuresand producing data representing tracks, being representative of theposition and speed of each respective point feature, within the image; alearning device receiving the data representing the tracks and producinga signal representing a range of behavior considered normal by thelearning device, in response to operation of a learning process on thedata representing the tracks; a classification device receiving both thesignal representing the normal range of behavior of the tracks and thedata representing the tracks, being adapted to compare the signal andthe data and to issue a normal/abnormal signal in accordance with theoutcome of such comparison; and an alarm generation device receiving thenormal/abnormal signal and generating at least one active alarm signalin response to the normal/abnormal signal indicating abnormal behaviorof at least one track. 16.-17. (canceled)